# mcp-threatintel

One request checks an IP, domain, hash or URL against OTX, AbuseIPDB, GreyNoise, abuse.ch and Feodo Tracker. Handy during incident response and security research.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 9
- Author: aplaceforallmystuff
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/aplaceforallmystuff/mcp-threatintel
- Updated: 2026-08-12
- HTML: https://affpapa.org/en/nevibecode/mcp/mcp-threatintel

## What it does

Point the server at an indicator and it queries every source you configured at once, so you stop juggling browser tabs. Each service has its own tool: `abuseipdb_check`, `otx_get_pulses`, `greynoise_ip`, `urlhaus_lookup`, `malwarebazaar_hash`, `threatfox_iocs`. Tools appear based on the keys you supply, and `threatintel_status` lists what is live.

Keys are optional. Feodo Tracker reads public JSON feeds with no authentication, so botnet C2 data is there right after setup. The rest wait on `OTX_API_KEY`, `ABUSEIPDB_API_KEY`, `GREYNOISE_API_KEY` and `ABUSECH_AUTH_KEY`. Node.js 18 or newer is required.

When one source fails, the combined lookup still returns whatever the others found. A 401 means the key is stale; a 429 means you hit the free-tier ceiling. Worth installing if you triage suspicious traffic or file hashes and would rather not visit each site by hand.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `OTX_API_KEY`, `ABUSEIPDB_API_KEY`, `GREYNOISE_API_KEY`, `ABUSECH_AUTH_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add mcp-threatintel -e OTX_API_KEY=<OTX_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -e GREYNOISE_API_KEY=<GREYNOISE_API_KEY> -e ABUSECH_AUTH_KEY=<ABUSECH_AUTH_KEY> -- npx -y mcp-threatintel-server
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add mcp-threatintel --env OTX_API_KEY=<OTX_API_KEY> --env ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> --env GREYNOISE_API_KEY=<GREYNOISE_API_KEY> --env ABUSECH_AUTH_KEY=<ABUSECH_AUTH_KEY> -- npx -y mcp-threatintel-server
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mcp-threatintel": {
            "command": "npx",
            "args": [
                "-y",
                "mcp-threatintel-server"
            ],
            "env": {
                "OTX_API_KEY": "<OTX_API_KEY>",
                "ABUSEIPDB_API_KEY": "<ABUSEIPDB_API_KEY>",
                "GREYNOISE_API_KEY": "<GREYNOISE_API_KEY>",
                "ABUSECH_AUTH_KEY": "<ABUSECH_AUTH_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mcp-threatintel": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "mcp-threatintel-server"
            ],
            "env": {
                "OTX_API_KEY": "<OTX_API_KEY>",
                "ABUSEIPDB_API_KEY": "<ABUSEIPDB_API_KEY>",
                "GREYNOISE_API_KEY": "<GREYNOISE_API_KEY>",
                "ABUSECH_AUTH_KEY": "<ABUSECH_AUTH_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e OTX_API_KEY=<OTX_API_KEY> -e ABUSEIPDB_API_KEY=<ABUSEIPDB_API_KEY> -e GREYNOISE_API_KEY=<GREYNOISE_API_KEY> -e ABUSECH_AUTH_KEY=<ABUSECH_AUTH_KEY> mcp-threatintel npx -y mcp-threatintel-server
```
Replace <…> with your own values

## When to use it
- check an IP against several reputation databases at once
- find a file hash in MalwareBazaar
- pull the latest IOCs from ThreatFox
- list active botnet C2 servers
- see whether a URL sits in any blocklist

## Example prompts
- Check 185.220.101.1 across all threat intel sources
- Is this SHA256 a known malware sample?
- Show active Emotet C2 servers from Feodo Tracker

## Similar
- [CrowdStrike Falcon MCP Server](https://affpapa.org/en/nevibecode/mcp/crowdstrike-falcon-mcp-server.md) — MCP server · ★ 273
- [malchela](https://affpapa.org/en/nevibecode/plugins/malchela.md) — plugin · ★ 117
- [k-skill-setup](https://affpapa.org/en/nevibecode/skills/k-skill-setup.md) — skill · 8400 installs
- [rivet-secure-exec](https://affpapa.org/en/nevibecode/skills/rivet-secure-exec.md) — skill · 945 installs
- [dependency-auditor](https://affpapa.org/en/nevibecode/skills/onewave-ai-dependency-auditor.md) — skill · 302 installs
- [agentgate](https://affpapa.org/en/nevibecode/mcp/agentgate.md) — MCP server · ★ 91

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md